What's the correct format of private_key when using it as an environment variable?

Question

I am trying to use private_key for some GCP service nodejs client libraries, e.g. @google-cloud/pubsub, @google-cloud/trace-agent

I got private_key from service account credential json file like this:

I am trying to use it as an environment variable for cloud function.

.env.yaml:

And use it like this:

// ...

  credentials: {
        private_key: envs.private_key,
        client_email: envs.client_email
  },
  projectId: envs.X_GOOGLE_GCLOUD_PROJECT

But got an error:

Error: error:0906D06C:PEM routines:PEM_read_bio:no start line

I check stackdriver logs, here is the private_key environment variable I got:

My guess is the format of private_key is not correct. It's probably caused by the newline symbol \n. So, what's the correct format when using private_key like this?

Answer 1

Setting the key in the .env.yaml file is not a good idea. Indeed, you will be able to commit it to git, maybe in a public repo, and you will set it in plain text as environment variable of your function.

It will be better if you set the file in a bucket, and load it in the runtime. BTW you will keep no secret in the project files.

Another solution is to encrypt with kms the key and decrypt it at runtime. This time you still have the secret in your project files, but encrypted.

But, what do you need another service account? This one on the function is not enough?